Qtch
Encyclopedia
qtch is a filetype used by QuickTime
to store (cache
) audio or video files streamed from a server on the client
's computer hard drive.
The first 16 bytes are:
This file type seems to have been introduced with QuickTime Player 7.x. The file is normally stored in any sub-directories of the following location:
these files had the correct a/v magic number and could be played by an appropriate player.
For example the first 16 bytes of an m4v
file are:
Using the Firefox browser the location of these files would be:
The first 16 bytes of the file are totally different:
From here both files are identical. To prove that the a/v information is intact within the qtch file you can replace the qtch file contents above this start a/v hex value with that from the QuickTime Player 6.x file and it will play normally.
It would not tell you the embedded file type.
Currently the only known way to establish the file type of a qtch file is to employ a packet sniffer
and search for the stream's file type as it is received by the network card
e.g. for QuickTime you would search for the leaf atom called ftyp.
Even then knowledge would be required to build the correct header to the point of the actual a/v data start.
would find no match in the a/v data.
QuickTime
QuickTime is an extensible proprietary multimedia framework developed by Apple Inc., capable of handling various formats of digital video, picture, sound, panoramic images, and interactivity. The classic version of QuickTime is available for Windows XP and later, as well as Mac OS X Leopard and...
to store (cache
Cache
In computer engineering, a cache is a component that transparently stores data so that future requests for that data can be served faster. The data that is stored within a cache might be values that have been computed earlier or duplicates of original values that are stored elsewhere...
) audio or video files streamed from a server on the client
Client (computing)
A client is an application or system that accesses a service made available by a server. The server is often on another computer system, in which case the client accesses the service by way of a network....
's computer hard drive.
The first 16 bytes are:
Hex ; ASCII
00 00 00 50 71 74 63 68 00 00 00 02 00 00 00 02 ; ...Pqtch........
This file type seems to have been introduced with QuickTime Player 7.x. The file is normally stored in any sub-directories of the following location:
| C:\Documents and Settings\ |
| E.G.: |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Apple Computer\QuickTime\downloads\08\02\82580278-44f0f184-c8c435b8-526b4f79.qtch |
Comparison with QuickTime Player 6.x
Previously QuickTime Player 6.x would store these audio and video(a/v) streams as files on the hard drive that had auto generated names such as '59B8794Ad01'. Unlike qtch files,these files had the correct a/v magic number and could be played by an appropriate player.
For example the first 16 bytes of an m4v
M4V
M4V is a file container format used by Apple's iTunes application. The M4V file format is a video file format developed by Apple and is very close to MP4 format...
file are:
Hex ; ASCII
00 00 00 20 66 74 79 70 4D 34 56 20 00 00 00 ; ... ftypM4V ...
Using the Firefox browser the location of these files would be:
| C:\Documents and Settings\ |
| E.G.: |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\jb4efpu5.default\Cache\59B8794Ad01 |
File Format Comparison between QuickTime Player 6.x and QuickTime Player 7.x
Although the files have different headers their a/v payload can often be the same(see iTunes exception below). In this example the same a/v file was streamed from a server and stored on the hard drive using QuickTime Player 6.x and QuickTime Player 7.x respectively :The first 16 bytes of the file are totally different:
| QuickTime Player 6.x |
| 00 00 00 14 66 74 79 70 33 67 70 34 00 00 04 00 ; ....ftyp3gp4.... |
| QuickTime Player 7.x |
| 00 00 00 50 71 74 63 68 00 00 00 02 00 00 00 02 ; ...Pqtch........ |
| However the a/v data starts at: |
| 7D 57 3F 1A 9A D6 CE 94 95 59 D0 CE 02 C1 E2 92 |
From here both files are identical. To prove that the a/v information is intact within the qtch file you can replace the qtch file contents above this start a/v hex value with that from the QuickTime Player 6.x file and it will play normally.
Identifying embedded file types within qtch
It may be impossible to know the filetype embedded within a qtch file without having a side by side comparison with the same file streamed using QuickTime Player 6.x (as above). Tools such as TrID/32 - File Identifier would, when analysing the file in the above example, only give you this information:
75.0% (.QTCH) Quicktime Cached data (9000/1)
It would not tell you the embedded file type.
Currently the only known way to establish the file type of a qtch file is to employ a packet sniffer
Packet sniffer
A packet analyzer is a computer program or a piece of computer hardware that can intercept and log traffic passing over a digital network or part of a network...
and search for the stream's file type as it is received by the network card
Network card
A network interface controller is a computer hardware component that connects a computer to a computer network....
e.g. for QuickTime you would search for the leaf atom called ftyp.
Even then knowledge would be required to build the correct header to the point of the actual a/v data start.
qtch files and iTunes
Although iTunes stores qtch files in the same way as described above the a/v content appears to be scrambled in some fashion so that a side by side comparison of the original file with the stored streamed filewould find no match in the a/v data.